@jeffusion/bungee-core 5.11.0 → 5.12.0

package/dist/plugins/chatgpt-oauth/control.js

@@ -506,7 +506,7 @@ var businessRpc = defineRpcService({ id: "chatgpt-oauth.credentials.v1", version
 } });
 
 // plugins/chatgpt-oauth/server/control.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 
 // plugins/chatgpt-oauth/server/oauth.ts
 import { createHash, randomBytes } from "crypto";
@@ -1025,8 +1025,181 @@ function extractCodexIdentity(idToken) {
   };
 }
 
+// plugins/chatgpt-oauth/server/siwc.ts
+import { createPublicKey, randomBytes as randomBytes2, randomUUID, verify } from "crypto";
+var SIWC_AUTH_URL = "https://auth.openai.com/api/accounts/authorize";
+var SIWC_TOKEN_URL = "https://auth.openai.com/api/accounts/oauth/token";
+var SIWC_JWKS_URL = "https://auth.openai.com/.well-known/jwks.json";
+var SIWC_ISSUER = "https://auth.openai.com";
+var SIWC_REDIRECT_URI = "http://127.0.0.1:1455/auth/callback";
+var SIWC_RESOURCE = "https://api.openai.com/v1";
+var SIWC_SCOPES = ["openid", "profile", "email", "offline_access", "resource.invoke", "chatgpt.tokens.use.direct"];
+var SIWC_REGISTRATION_KEY = "siwc.registration.v1";
+var CLIENT_ID = /^oaiapp_[A-Za-z0-9_-]{1,200}$/;
+var HOST_ID = /^urn:uuid:[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+function invalid(kind = "invalid_response") {
+  throw new CodexOAuthError(kind, `SIWC ${kind === "invalid_callback" ? "callback" : "response"} is invalid`, { retryable: false });
+}
+async function getSiwcHostId(store, canWrite = () => true) {
+  for (let attempt = 0;attempt < 12; attempt++) {
+    if (!canWrite())
+      throw new CodexOAuthError("cancelled", "SIWC operation was cancelled", { retryable: false });
+    const current = await store.get(SIWC_REGISTRATION_KEY);
+    if (current) {
+      try {
+        const record = JSON.parse(current.value);
+        if (record?.schema === 1 && typeof record.hostId === "string" && HOST_ID.test(record.hostId))
+          return record.hostId;
+      } catch {}
+      return invalid();
+    }
+    const hostId = `urn:uuid:${randomUUID()}`;
+    if (!canWrite())
+      throw new CodexOAuthError("cancelled", "SIWC operation was cancelled", { retryable: false });
+    try {
+      await store.compareAndSet(SIWC_REGISTRATION_KEY, null, JSON.stringify({ schema: 1, hostId }));
+      return hostId;
+    } catch (error) {
+      if (error.code !== "version_conflict")
+        throw error;
+    }
+  }
+  return invalid();
+}
+function validSiwcMetadata(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return false;
+  const item = value;
+  return Object.keys(item).every((key) => ["clientId", "subject", "scopes"].includes(key)) && typeof item.clientId === "string" && CLIENT_ID.test(item.clientId) && typeof item.subject === "string" && item.subject.length > 0 && item.subject.length <= 512 && item.subject.trim() === item.subject && !/[\u0000-\u001f\u007f]/.test(item.subject) && Array.isArray(item.scopes) && item.scopes.length <= 128 && item.scopes.every((scope) => typeof scope === "string" && /^[\x21\x23-\x5b\x5d-\x7e]{1,128}$/.test(scope)) && item.scopes.includes("resource.invoke") && item.scopes.includes("chatgpt.tokens.use.direct");
+}
+function createSiwcNonce(random = randomBytes2) {
+  return Buffer.from(random(32)).toString("base64url");
+}
+function buildSiwcAuthorizationUrl(pkce, nonce, hostId, clientId) {
+  if (!HOST_ID.test(hostId) || clientId !== undefined && !CLIENT_ID.test(clientId) || !nonce || !pkce.state || !pkce.codeChallenge)
+    return invalid();
+  const url = new URL(SIWC_AUTH_URL);
+  url.search = new URLSearchParams({
+    client_id: clientId ?? "dynamic_agent_client",
+    agent_name_hint: "Bungee",
+    ext_agent_host_id: hostId,
+    response_type: "code",
+    redirect_uri: SIWC_REDIRECT_URI,
+    resource: SIWC_RESOURCE,
+    scope: SIWC_SCOPES.join(" "),
+    state: pkce.state,
+    nonce,
+    code_challenge: pkce.codeChallenge,
+    code_challenge_method: "S256"
+  }).toString();
+  return url.toString();
+}
+function parseSiwcCallbackUrl(raw, options) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return invalid("invalid_callback");
+  }
+  const expected = new URL(SIWC_REDIRECT_URI);
+  const now = options.now ?? Date.now();
+  if (raw.length > 4096 || raw.trim() !== raw || raw.split("?")[0] !== SIWC_REDIRECT_URI || url.origin !== expected.origin || url.pathname !== expected.pathname || url.username || url.password || url.hash || !Number.isFinite(now) || !Number.isFinite(options.issuedAt) || options.issuedAt < 0 || now < options.issuedAt || now - options.issuedAt > CODEX_CALLBACK_TTL_MS || [...url.searchParams.keys()].some((key) => url.searchParams.getAll(key).length !== 1) || url.searchParams.has("userinfo") || !options.expectedState || url.searchParams.get("state") !== options.expectedState || url.searchParams.has("error") || url.searchParams.has("error_description"))
+    return invalid("invalid_callback");
+  const code = url.searchParams.get("code");
+  const clientId = url.searchParams.get("client_id");
+  if (!code || code.trim() !== code || /[\u0000-\u001f\u007f]/.test(code) || !clientId || !CLIENT_ID.test(clientId) || options.expectedClientId !== undefined && clientId !== options.expectedClientId)
+    return invalid("invalid_callback");
+  return { code, clientId };
+}
+function jwtObject(part) {
+  try {
+    if (!/^[A-Za-z0-9_-]+$/.test(part))
+      return invalid();
+    const value = JSON.parse(Buffer.from(part, "base64url").toString("utf8"));
+    if (value && typeof value === "object" && !Array.isArray(value))
+      return value;
+  } catch {}
+  return invalid();
+}
+async function verifySiwcIdToken(idToken, expected, options = {}) {
+  if (!CLIENT_ID.test(expected.clientId) || idToken.length > 32768)
+    return invalid();
+  const parts = idToken.split(".");
+  if (parts.length !== 3 || !/^[A-Za-z0-9_-]+$/.test(parts[2]))
+    return invalid();
+  const header = jwtObject(parts[0]);
+  const payload = jwtObject(parts[1]);
+  if (header.alg !== "RS256" || typeof header.kid !== "string" || !header.kid || header.crit !== undefined)
+    return invalid();
+  const jwks = await requestJson(SIWC_JWKS_URL, { method: "GET", headers: { accept: "application/json" } }, options);
+  if (!Array.isArray(jwks.keys) || jwks.keys.length > 128)
+    return invalid();
+  const keys = jwks.keys.filter((key) => key && typeof key === "object" && key.kid === header.kid && key.kty === "RSA" && (key.alg === undefined || key.alg === "RS256") && (key.use === undefined || key.use === "sig") && (key.key_ops === undefined || Array.isArray(key.key_ops) && key.key_ops.includes("verify")) && key.d === undefined);
+  if (keys.length !== 1)
+    return invalid();
+  try {
+    const publicKey = createPublicKey({ key: keys[0], format: "jwk" });
+    if (!verify("RSA-SHA256", Buffer.from(`${parts[0]}.${parts[1]}`), publicKey, Buffer.from(parts[2], "base64url")))
+      return invalid();
+  } catch {
+    return invalid();
+  }
+  const aud = payload.aud;
+  const now = expected.now ?? Date.now();
+  if (payload.iss !== SIWC_ISSUER || !(aud === expected.clientId || Array.isArray(aud) && aud.every((item) => typeof item === "string") && aud.includes(expected.clientId)) || Array.isArray(aud) && aud.length > 1 && payload.azp !== expected.clientId || payload.azp !== undefined && payload.azp !== expected.clientId || typeof payload.exp !== "number" || !Number.isFinite(payload.exp) || !Number.isFinite(now) || payload.exp * 1000 <= now || payload.nbf !== undefined && (typeof payload.nbf !== "number" || !Number.isFinite(payload.nbf) || payload.nbf * 1000 > now) || typeof payload.sub !== "string" || !payload.sub || payload.sub.length > 512 || payload.sub.trim() !== payload.sub || /[\u0000-\u001f\u007f]/.test(payload.sub) || expected.nonce !== undefined && payload.nonce !== expected.nonce || expected.subject !== undefined && payload.sub !== expected.subject)
+    return invalid();
+  return { subject: payload.sub, email: typeof payload.email === "string" && payload.email.length <= 512 && !/[\u0000-\u001f\u007f]/.test(payload.email) ? payload.email : undefined };
+}
+function tokenString(record, key, fallback) {
+  if (record[key] === undefined && fallback !== undefined)
+    return fallback;
+  const value = record[key];
+  if (typeof value !== "string" || !value || value.trim() !== value || value.length > 32768 || /[\r\n\0]/.test(value))
+    return invalid();
+  return value;
+}
+async function siwcTokenSet(record, expected, options, previous) {
+  const accessToken = tokenString(record, "access_token");
+  const refreshToken = tokenString(record, "refresh_token", previous?.refreshToken);
+  const idToken = tokenString(record, "id_token", previous?.idToken);
+  if (record.token_type !== undefined && (typeof record.token_type !== "string" || record.token_type.toLowerCase() !== "bearer"))
+    return invalid();
+  if (typeof record.expires_in !== "number" || !Number.isFinite(record.expires_in) || record.expires_in <= 0 || record.expires_in * 1000 > Number.MAX_SAFE_INTEGER - Date.now())
+    return invalid();
+  const scopes = record.scope === undefined && previous?.siwc ? [...previous.siwc.scopes] : tokenString(record, "scope").split(/\s+/);
+  const verified = record.id_token === undefined && previous?.siwc ? { subject: previous.siwc.subject, email: previous.identity?.email } : await verifySiwcIdToken(idToken, expected, options);
+  const siwc = { clientId: expected.clientId, subject: verified.subject, scopes };
+  if (!validSiwcMetadata(siwc))
+    return invalid();
+  return {
+    accessToken,
+    refreshToken,
+    idToken,
+    expiresIn: record.expires_in,
+    expiresAt: Date.now() + record.expires_in * 1000,
+    tokenType: "Bearer",
+    identity: { email: verified.email },
+    identityStatus: "parsed",
+    siwc
+  };
+}
+async function exchangeSiwcCode(code, codeVerifier, clientId, nonce, options = {}) {
+  if (!code || !codeVerifier || !nonce || !CLIENT_ID.test(clientId))
+    return invalid();
+  const body = new URLSearchParams({ grant_type: "authorization_code", client_id: clientId, code, code_verifier: codeVerifier, redirect_uri: SIWC_REDIRECT_URI, resource: SIWC_RESOURCE });
+  const record = await requestJson(SIWC_TOKEN_URL, { method: "POST", headers: { accept: "application/json", "content-type": "application/x-www-form-urlencoded" }, body: body.toString() }, options);
+  return siwcTokenSet(record, { clientId, nonce }, options);
+}
+async function refreshSiwcToken(previous, options = {}) {
+  if (!validSiwcMetadata(previous.siwc) || !previous.refreshToken)
+    return invalid();
+  const body = new URLSearchParams({ grant_type: "refresh_token", client_id: previous.siwc.clientId, refresh_token: previous.refreshToken, resource: SIWC_RESOURCE });
+  const record = await requestJson(SIWC_TOKEN_URL, { method: "POST", headers: { accept: "application/json", "content-type": "application/x-www-form-urlencoded" }, body: body.toString() }, options, true);
+  return siwcTokenSet(record, { clientId: previous.siwc.clientId, subject: previous.siwc.subject }, options, previous);
+}
+
 // plugins/chatgpt-oauth/server/accounts.ts
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 var ACCOUNT_STORE_KEY = "accounts.v1";
 var ACCOUNT_SCHEMA_VERSION = 1;
 
@@ -1059,6 +1232,7 @@ function copyIdentity(value) {
 function copyAccount(value) {
   return {
     ...value,
+    siwc: value.siwc && { ...value.siwc, scopes: [...value.siwc.scopes] },
     identity: copyIdentity(value.identity),
     refreshLock: value.refreshLock && { ...value.refreshLock },
     autoResetAttempts: value.autoResetAttempts?.map((item) => ({ ...item }))
@@ -1071,7 +1245,7 @@ function validStoredAccount(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value))
     return false;
   const account = value;
-  return typeof account.id === "string" && account.id.length > 0 && account.id.length <= 128 && typeof account.label === "string" && account.label.length > 0 && account.label.length <= MAX_TEXT && ["active", "disabled", "reauth_required", "revoked"].includes(account.status) && Number.isSafeInteger(account.generation) && account.generation > 0 && (account.loginFence === undefined || Number.isSafeInteger(account.loginFence) && account.loginFence > 0) && (account.credentialValid === undefined || typeof account.credentialValid === "boolean") && (account.autoResetCredits === undefined || typeof account.autoResetCredits === "boolean") && validAutoResetAttempts(account.autoResetAttempts) && Number.isFinite(account.createdAt) && Number.isFinite(account.updatedAt);
+  return typeof account.id === "string" && account.id.length > 0 && account.id.length <= 128 && typeof account.label === "string" && account.label.length > 0 && account.label.length <= MAX_TEXT && ["active", "disabled", "reauth_required", "revoked"].includes(account.status) && Number.isSafeInteger(account.generation) && account.generation > 0 && (account.loginFence === undefined || Number.isSafeInteger(account.loginFence) && account.loginFence > 0) && (account.credentialValid === undefined || typeof account.credentialValid === "boolean") && (account.autoResetCredits === undefined || typeof account.autoResetCredits === "boolean") && (account.siwc === undefined || validSiwcMetadata(account.siwc)) && validAutoResetAttempts(account.autoResetAttempts) && Number.isFinite(account.createdAt) && Number.isFinite(account.updatedAt);
 }
 function decode(value) {
   if (value === undefined)
@@ -1107,6 +1281,7 @@ function statusReason(account) {
 function accountListItem(account) {
   const pending = account.autoResetAttempts?.find((item) => !item.completed);
   return {
+    authType: account.siwc ? "siwc" : "codex",
     id: account.id,
     label: account.label,
     status: account.status,
@@ -1114,10 +1289,25 @@ function accountListItem(account) {
     reason: statusReason(account),
     expiresAt: account.expiresAt,
     identity: copyIdentity(account.identity),
-    autoResetCredits: account.autoResetCredits === true,
-    pendingAutoReset: pending && { ...pending }
+    autoResetCredits: !account.siwc && account.autoResetCredits === true,
+    pendingAutoReset: !account.siwc && pending ? { ...pending } : undefined
   };
 }
+function validateTokenIdentity(token) {
+  if (token.identityStatus !== "parsed" || (token.siwc === undefined ? !token.identity?.accountId : !validSiwcMetadata(token.siwc))) {
+    throw new AccountControlError("invalid_identity");
+  }
+}
+function validateSiwcBinding(account, token) {
+  if (Boolean(account.siwc) !== Boolean(token.siwc))
+    throw new AccountControlError("identity_mismatch");
+  if (account.siwc) {
+    if (!validSiwcMetadata(token.siwc) || token.identityStatus !== "parsed")
+      throw new AccountControlError("invalid_identity");
+    if (account.siwc.clientId !== token.siwc.clientId || account.siwc.subject !== token.siwc.subject)
+      throw new AccountControlError("identity_mismatch");
+  }
+}
 
 class AccountStore {
   secretStore;
@@ -1152,6 +1342,19 @@ class AccountStore {
   async list() {
     return (await this.read()).aggregate.accounts.map(accountListItem);
   }
+  async remove(id) {
+    text(id, 128);
+    await this.mutate((aggregate) => {
+      aggregate.accounts = aggregate.accounts.filter((account) => account.id !== id);
+    });
+  }
+  async purgeRevoked() {
+    if (!(await this.read()).aggregate.accounts.some((account) => account.status === "revoked"))
+      return;
+    await this.mutate((aggregate) => {
+      aggregate.accounts = aggregate.accounts.filter((account) => account.status !== "revoked");
+    });
+  }
   async get(id) {
     const account = (await this.read()).aggregate.accounts.find((item) => item.id === id);
     if (!account)
@@ -1160,14 +1363,13 @@ class AccountStore {
   }
   async create(label, token, canCommit = () => true) {
     text(label);
-    if (token.identityStatus !== "parsed" || !token.identity?.accountId)
-      throw new AccountControlError("invalid_identity");
+    validateTokenIdentity(token);
     return this.mutate((aggregate) => {
       if (aggregate.accounts.length >= MAX_ACCOUNTS)
         throw new AccountControlError("invalid_input");
       const now = Date.now();
       const account = {
-        id: randomUUID(),
+        id: randomUUID2(),
         label,
         status: token.expiresAt === undefined ? "reauth_required" : "active",
         generation: 1,
@@ -1179,7 +1381,8 @@ class AccountStore {
         refreshToken: text(token.refreshToken, MAX_TOKEN),
         idToken: optionalText(token.idToken, MAX_TOKEN),
         expiresAt: token.expiresAt,
-        identity: copyIdentity(token.identity)
+        identity: copyIdentity(token.identity),
+        siwc: token.siwc && { ...token.siwc, scopes: [...token.siwc.scopes] }
       };
       aggregate.accounts.push(account);
       return copyAccount(account);
@@ -1203,7 +1406,9 @@ class AccountStore {
       if (token.identity?.accountId && account.identity?.accountId && token.identity.accountId !== account.identity.accountId) {
         throw new AccountControlError("identity_mismatch");
       }
+      validateSiwcBinding(account, token);
       const now = Date.now();
+      account.siwc = token.siwc && { ...token.siwc, scopes: [...token.siwc.scopes] };
       account.accessToken = text(token.accessToken, MAX_TOKEN);
       account.refreshToken = text(token.refreshToken, MAX_TOKEN);
       if (token.idToken !== undefined && token.identityStatus !== "invalid")
@@ -1245,9 +1450,9 @@ class AccountStore {
       if (account.generation !== expected.generation || account.loginFence !== expected.loginFence) {
         throw new AccountControlError("stale_refresh");
       }
-      if (token.identityStatus !== "parsed" || !token.identity?.accountId)
-        throw new AccountControlError("invalid_identity");
-      if (account.identity?.accountId && token.identity.accountId !== account.identity.accountId) {
+      validateTokenIdentity(token);
+      validateSiwcBinding(account, token);
+      if (account.identity?.accountId && token.identity?.accountId !== account.identity.accountId) {
         throw new AccountControlError("identity_mismatch");
       }
       account.accessToken = text(token.accessToken, MAX_TOKEN);
@@ -1264,6 +1469,7 @@ class AccountStore {
         account.status = "active";
       }
       account.identity = copyIdentity(token.identity);
+      account.siwc = token.siwc && { ...token.siwc, scopes: [...token.siwc.scopes] };
       account.generation += 1;
       account.updatedAt = Date.now();
       delete account.refreshLock;
@@ -1275,22 +1481,12 @@ class AccountStore {
       const account = aggregate.accounts.find((item) => item.id === id);
       if (!account)
         throw new AccountControlError("not_found");
-      if (account.status === "revoked") {
-        if (status === "revoked")
-          return copyAccount(account);
+      if (account.status === "revoked")
         throw new AccountControlError("revoked");
-      }
       account.status = status;
       account.generation += 1;
       account.updatedAt = Date.now();
       delete account.refreshLock;
-      if (status === "revoked") {
-        delete account.accessToken;
-        delete account.refreshToken;
-        delete account.idToken;
-        delete account.expiresAt;
-        account.credentialValid = false;
-      }
       return copyAccount(account);
     });
   }
@@ -1316,6 +1512,8 @@ class AccountStore {
         throw new AccountControlError("not_found");
       if (account.status === "revoked")
         throw new AccountControlError("revoked");
+      if (account.siwc)
+        throw new AccountControlError("unsupported_operation");
       account.autoResetCredits = enabled;
       account.updatedAt = Date.now();
       return copyAccount(account);
@@ -1324,7 +1522,7 @@ class AccountStore {
   async claimAutoReset(id, credit, now) {
     return this.mutate((aggregate) => {
       const account = aggregate.accounts.find((item) => item.id === id);
-      if (!account || !accountListItem(account).available || account.autoResetCredits !== true)
+      if (!account || account.siwc || !accountListItem(account).available || account.autoResetCredits !== true)
         return;
       const attempts = account.autoResetAttempts ?? [];
       if (attempts.some((item) => !item.completed || item.creditId === credit.id))
@@ -1332,7 +1530,7 @@ class AccountStore {
       account.autoResetAttempts = attempts.filter((item) => !item.completed || item.expiresAt === undefined || item.expiresAt > now);
       if (account.autoResetAttempts.length >= MAX_AUTO_RESET_ATTEMPTS || credit.expiresAt === undefined || credit.expiresAt <= now)
         return;
-      const attempt = { creditId: credit.id, redeemRequestId: randomUUID(), expiresAt: credit.expiresAt, completed: false };
+      const attempt = { creditId: credit.id, redeemRequestId: randomUUID2(), expiresAt: credit.expiresAt, completed: false };
       account.autoResetAttempts.push(attempt);
       account.updatedAt = Date.now();
       return { ...attempt };
@@ -1343,6 +1541,8 @@ class AccountStore {
       const account = aggregate.accounts.find((item) => item.id === id);
       if (!account)
         throw new AccountControlError("not_found");
+      if (account.siwc)
+        throw new AccountControlError("unsupported_operation");
       const attempts = account.autoResetAttempts ?? [];
       const pending = attempts.find((item) => !item.completed);
       if (pending) {
@@ -1451,7 +1651,7 @@ class AccountStore {
 }
 
 // plugins/chatgpt-oauth/server/sessions.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 class LoginSessionError extends Error {
   code;
   name = "LoginSessionError";
@@ -1494,7 +1694,7 @@ class LoginSessionManager {
     this.hostSignal.addEventListener("abort", onHostAbort, { once: true });
     const issuedAt = this.now();
     const session = {
-      id: randomUUID2(),
+      id: randomUUID3(),
       kind,
       state: "pending",
       issuedAt,
@@ -1582,6 +1782,19 @@ class LoginSessionManager {
     session.codeVerifier = pkce.codeVerifier;
     return { sessionId: session.id, authorizationUrl: buildCodexAuthorizationUrl(pkce), expiresAt: session.expiresAt };
   }
+  startSiwc(hostId, accountRef, clientId, fence) {
+    if (accountRef !== undefined && (typeof accountRef !== "string" || !accountRef || accountRef.length > 128))
+      throw new LoginSessionError("invalid_input");
+    const pkce = createPKCE(this.deps.random);
+    const nonce = createSiwcNonce(this.deps.random);
+    const authorizationUrl = buildSiwcAuthorizationUrl(pkce, nonce, hostId, clientId);
+    const session = this.newSession("siwc", accountRef, fence, CODEX_CALLBACK_TTL_MS);
+    session.stateValue = pkce.state;
+    session.codeVerifier = pkce.codeVerifier;
+    session.nonce = nonce;
+    session.clientId = clientId;
+    return { sessionId: session.id, authorizationUrl, expiresAt: session.expiresAt };
+  }
   setFence(id, fence) {
     const session = this.get(id);
     if (session.state !== "pending")
@@ -1694,6 +1907,24 @@ class LoginSessionManager {
       throw error;
     }
   }
+  async completeSiwc(id, callbackUrl, commit) {
+    const session = this.claim(id, "siwc");
+    try {
+      const callback = parseSiwcCallbackUrl(callbackUrl, { expectedState: session.stateValue, expectedClientId: session.clientId, issuedAt: session.issuedAt, now: this.now() });
+      const token = await exchangeSiwcCode(callback.code, session.codeVerifier, callback.clientId, session.nonce, safeOptions(this.deps, session.controller.signal));
+      return await this.finish(session, token, commit);
+    } catch (error) {
+      if (session.controller.signal.aborted && session.state === "cancelled")
+        throw new LoginSessionError("cancelled");
+      if (session.state === "exchanging") {
+        session.state = session.controller.signal.aborted ? "cancelled" : "failed";
+        session.errorCode = session.controller.signal.aborted ? "cancelled" : "login_failed";
+        if (session.state === "failed")
+          throw new LoginSessionError("failed");
+      }
+      throw error;
+    }
+  }
   cancel(id) {
     const session = this.get(id);
     if (session.state === "success" || session.state === "cancelled" || session.state === "failed" || session.state === "committing")
@@ -2462,6 +2693,7 @@ class AutoResetScheduler {
 
 // plugins/chatgpt-oauth/server/control.ts
 var CHATGPT_TARGET = "https://chatgpt.com";
+var SIWC_TARGET = "https://api.openai.com";
 var CONTROL_HOST_CONTRACT_GAP = "ControlRpcContext.binding.bindingOptions.accountRef is required and host-resolved; RPC payload is never used as a fallback.";
 
 class ControlError extends Error {
@@ -2488,7 +2720,8 @@ function safeError(error) {
       identity_mismatch: "identity_mismatch",
       invalid_identity: "invalid_identity",
       disposed: "disposed",
-      stale_refresh: "stale_refresh"
+      stale_refresh: "stale_refresh",
+      unsupported_operation: "unsupported_operation"
     };
     return new ControlError(map[error.code] ?? "refresh_failed");
   }
@@ -2653,6 +2886,11 @@ function lease(account) {
     throw new ControlError(account.status);
   if (!account.accessToken)
     throw new ControlError("reauth_required");
+  if (account.siwc) {
+    if (!validSiwcMetadata(account.siwc) || !Number.isFinite(account.expiresAt))
+      throw new ControlError("reauth_required");
+    return { version: account.generation, expiresAt: account.expiresAt, headers: { Authorization: `Bearer ${account.accessToken}` } };
+  }
   if (!account.identity?.accountId)
     throw new ControlError("identity_missing");
   if (!Number.isFinite(account.expiresAt))
@@ -2671,7 +2909,7 @@ class ChatgptControl {
   accounts;
   sessions;
   now;
-  workerOwner = `chatgpt-control-${randomUUID3()}`;
+  workerOwner = `chatgpt-control-${randomUUID4()}`;
   inFlight = new Map;
   refreshControllers = new Map;
   apiLifetime = new AbortController;
@@ -2690,7 +2928,7 @@ class ChatgptControl {
       now: this.now,
       timeoutMs: deps.timeoutMs,
       hostSignal: this.apiLifetime.signal,
-      credential: (id, signal) => this.credential(id, signal),
+      credential: (id, signal) => this.credential(id, signal, "codex"),
       rejectAccess: (id, version) => this.accounts.rejectAccess(id, version)
     });
     this.autoReset = new AutoResetScheduler(this.accounts, this.usage, this.apiLifetime.signal, this.now, deps.autoResetTimer);
@@ -2718,7 +2956,7 @@ class ChatgptControl {
   }
   async start() {
     this.assertAlive();
-    await this.accounts.read();
+    await this.accounts.purgeRevoked();
     this.assertAlive();
     this.autoReset.start();
   }
@@ -2741,7 +2979,8 @@ class ChatgptControl {
       }
       const generation = lock.account.generation;
       try {
-        const token = await refreshCodexToken(lock.account.refreshToken, { fetchImpl: this.deps.fetchImpl, signal });
+        const refreshOptions = { fetchImpl: this.deps.fetchImpl, signal, timeoutMs: this.deps.timeoutMs };
+        const token = lock.account.siwc ? await refreshSiwcToken({ accessToken: lock.account.accessToken, refreshToken: lock.account.refreshToken, idToken: lock.account.idToken, identity: lock.account.identity, identityStatus: "parsed", siwc: lock.account.siwc }, refreshOptions) : await refreshCodexToken(lock.account.refreshToken, refreshOptions);
         this.assertAlive(signal);
         const updated = await this.accounts.replaceCredentials(id, token, { owner: this.workerOwner, generation });
         this.assertAlive(signal);
@@ -2750,12 +2989,14 @@ class ChatgptControl {
         if (this.disposed || this.host.signal.aborted)
           throw new ControlError("disposed");
         const oauthCode = error.kind;
-        if (oauthCode === "refresh_token_reused") {
+        if (oauthCode === "refresh_token_reused" || lock.account.siwc && (error.upstreamCode === "invalid_grant" || oauthCode === "invalid_response" || error instanceof AccountControlError && ["identity_mismatch", "invalid_identity"].includes(error.code))) {
           const fenced = await this.accounts.failRefreshReauth(id, this.workerOwner, generation).catch(() => false);
           if (!fenced) {
             const latest = await this.accounts.get(id).catch(() => {
               return;
             });
+            if (!latest)
+              throw new ControlError("not_found");
             if (latest?.status === "revoked")
               throw new ControlError("revoked");
             if (latest?.status === "disabled")
@@ -2772,6 +3013,8 @@ class ChatgptControl {
           const latest = await this.accounts.get(id).catch(() => {
             return;
           });
+          if (!latest)
+            throw new ControlError("not_found");
           if (latest?.status === "revoked")
             throw new ControlError("revoked");
           if (latest?.status === "disabled")
@@ -2786,10 +3029,38 @@ class ChatgptControl {
     }
     throw new ControlError("refresh_in_progress");
   }
-  async credential(id, signal) {
+  async requireKind(id, kind, error = "source_mismatch") {
+    const account = await this.accounts.get(id);
+    if (Boolean(account.siwc) !== (kind === "siwc"))
+      throw new ControlError(error);
+    return account;
+  }
+  async bindingAccount(context) {
+    const id = accountRefFromBinding(context);
+    const source = context.binding.contributionId;
+    if (source === "chatgpt-siwc")
+      await this.requireKind(id, "siwc");
+    else if (source === "chatgpt" || source === "upstream")
+      await this.requireKind(id, "codex");
+    else
+      throw new ControlError("source_mismatch");
+    return id;
+  }
+  async draft(context, kind) {
+    const body = await this.readJson(context);
+    exactKeys(body, ["accountRef"]);
+    const account = await this.requireKind(requiredText(body.accountRef, 128), kind);
+    if (!accountListItem(account).available)
+      throw new ControlError(account.status === "active" ? "reauth_required" : account.status);
+    const draft = { target: kind === "siwc" ? SIWC_TARGET : CHATGPT_TARGET, bindingOptions: { accountRef: account.id } };
+    return jsonResponse(draft);
+  }
+  async credential(id, signal, kind) {
     this.assertAlive(signal);
     const account = await this.accounts.get(id);
     this.assertAlive(signal);
+    if (kind === "codex" && account.siwc)
+      throw new ControlError("unsupported_operation");
     if (account.status !== "active")
       throw new ControlError(account.status);
     if (!isRefreshable(account, this.now())) {
@@ -2830,6 +3101,8 @@ class ChatgptControl {
     return readRequestJson(context.request, context.requestSignal, context.signal, this.apiLifetime.signal);
   }
   async startDevice(accountRef) {
+    if (accountRef !== undefined)
+      await this.requireKind(accountRef, "codex");
     const started = await this.sessions.startDevice(accountRef, () => this.loginFence(accountRef));
     this.sessions.completeDevice(started.sessionId, (token, info, guard) => this.commitLogin(token, info, guard)).catch(() => {
       return;
@@ -2854,11 +3127,17 @@ class ChatgptControl {
     };
     return [
       { path: "/accounts", methods: ["GET"], handler: "listAccounts", invoke: invoke(async () => jsonResponse({ accounts: await this.accounts.list() })) },
-      { path: "/accounts/usage", methods: ["GET"], handler: "getAccountUsage", invoke: invoke(async (context) => jsonResponse(await this.usage.get(this.accountRefQuery(context.request), context.requestSignal))) },
+      { path: "/accounts/codex", methods: ["GET"], handler: "listCodexAccounts", invoke: invoke(async () => jsonResponse({ accounts: (await this.accounts.list()).filter((account) => account.authType === "codex") })) },
+      { path: "/accounts/siwc", methods: ["GET"], handler: "listSiwcAccounts", invoke: invoke(async () => jsonResponse({ accounts: (await this.accounts.list()).filter((account) => account.authType === "siwc") })) },
+      { path: "/accounts/usage", methods: ["GET"], handler: "getAccountUsage", invoke: invoke(async (context) => {
+        const id = this.accountRefQuery(context.request);
+        return jsonResponse(await this.usage.get(id, context.requestSignal));
+      }) },
       { path: "/accounts/usage/reset", methods: ["POST"], handler: "resetAccountUsage", invoke: invoke(async (context) => {
         const body = await this.readJson(context);
         exactKeys(body, ["accountRef", "redeemRequestId", "creditId"]);
         const accountRef = requiredText(body.accountRef, 128);
+        await this.requireKind(accountRef, "codex", "unsupported_operation");
         const redeemRequestId = requiredText(body.redeemRequestId, 128);
         if (!/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(redeemRequestId))
           throw new ControlError("invalid_input");
@@ -2885,14 +3164,18 @@ class ChatgptControl {
           throw new ControlError("invalid_input");
         return jsonResponse({ account: accountListItem(await this.accounts.setAutoResetCredits(requiredText(body.accountRef, 128), body.enabled)) });
       }) },
-      { path: "/accounts/draft", methods: ["POST"], handler: "createDraft", invoke: invoke(async (context) => {
+      { path: "/accounts/draft", methods: ["POST"], handler: "createDraft", invoke: invoke((context) => this.draft(context, "codex")) },
+      { path: "/accounts/siwc/draft", methods: ["POST"], handler: "createSiwcDraft", invoke: invoke((context) => this.draft(context, "siwc")) },
+      { path: "/login/siwc", methods: ["POST"], handler: "startSiwcLogin", invoke: invoke(async (context) => {
         const body = await this.readJson(context);
         exactKeys(body, ["accountRef"]);
-        const account = await this.accounts.get(requiredText(body.accountRef, 128));
-        if (!accountListItem(account).available)
-          throw new ControlError(account.status === "active" ? "reauth_required" : account.status);
-        const draft = { target: CHATGPT_TARGET, bindingOptions: { accountRef: account.id } };
-        return jsonResponse(draft);
+        const accountRef = optionalText3(body.accountRef, 128);
+        const account = accountRef === undefined ? undefined : await this.requireKind(accountRef, "siwc");
+        const hostId = await getSiwcHostId(this.host.secretStore, () => !this.disposed && !this.host.signal.aborted);
+        this.assertAlive(context.requestSignal);
+        const fence = await this.loginFence(accountRef);
+        this.assertAlive(context.requestSignal);
+        return jsonResponse(this.sessions.startSiwc(hostId, accountRef, account?.siwc?.clientId, fence));
       }) },
       { path: "/login/device", methods: ["POST"], handler: "startDeviceLogin", invoke: invoke(async (context) => {
         const body = await this.readJson(context);
@@ -2903,6 +3186,8 @@ class ChatgptControl {
         const body = await this.readJson(context);
         exactKeys(body, ["accountRef"]);
         const accountRef = optionalText3(body.accountRef, 128);
+        if (accountRef !== undefined)
+          await this.requireKind(accountRef, "codex");
         const started = this.sessions.startPkce(accountRef);
         try {
           if (accountRef !== undefined)
@@ -2927,7 +3212,8 @@ class ChatgptControl {
         const status = this.sessions.status(sessionId);
         if (status.state !== "pending")
           return jsonResponse(status);
-        const result = await this.sessions.completePkce(sessionId, requiredText(body.callbackUrl, 4096), (token, info, guard) => this.commitLogin(token, info, guard));
+        const complete = status.kind === "siwc" ? this.sessions.completeSiwc.bind(this.sessions) : this.sessions.completePkce.bind(this.sessions);
+        const result = await complete(sessionId, requiredText(body.callbackUrl, 4096), (token, info, guard) => this.commitLogin(token, info, guard));
         return jsonResponse({ account: result.result });
       }) },
       { path: "/login/device/complete", methods: ["POST"], handler: "completeDeviceLogin", invoke: invoke(async (context) => {
@@ -2969,9 +3255,9 @@ class ChatgptControl {
         const body = await this.readJson(context);
         exactKeys(body, ["accountRef"]);
         const accountRef = requiredText(body.accountRef, 128);
-        const account = await this.accounts.setStatus(accountRef, "revoked");
+        await this.accounts.remove(accountRef);
         this.usage.invalidateAccount(accountRef);
-        return jsonResponse({ account: accountListItem(account) });
+        return jsonResponse({ deleted: true });
       }) }
     ];
   }
@@ -2980,7 +3266,7 @@ class ChatgptControl {
       { name: "getCredential", handler: "getCredential", invoke: async (_payload, context) => {
         try {
           this.assertAlive(context.attempt.signal);
-          return await this.credential(accountRefFromBinding(context), context.attempt.signal);
+          return await this.credential(await this.bindingAccount(context), context.attempt.signal);
         } catch (error) {
           throw safeError(error);
         }
@@ -2990,7 +3276,7 @@ class ChatgptControl {
           this.assertAlive(context.attempt.signal);
           const body = record(payload);
           exactKeys(body, ["version"]);
-          return { rejected: await this.accounts.rejectAccess(accountRefFromBinding(context), requiredVersion(body.version)) };
+          return { rejected: await this.accounts.rejectAccess(await this.bindingAccount(context), requiredVersion(body.version)) };
         } catch (error) {
           throw safeError(error);
         }
@@ -3016,10 +3302,14 @@ function createControl(context, dependencies = {}) {
 }
 var api = Object.freeze([
   { path: "/accounts", methods: ["GET"], handler: "listAccounts" },
+  { path: "/accounts/codex", methods: ["GET"], handler: "listCodexAccounts" },
+  { path: "/accounts/siwc", methods: ["GET"], handler: "listSiwcAccounts" },
   { path: "/accounts/usage", methods: ["GET"], handler: "getAccountUsage" },
   { path: "/accounts/usage/reset", methods: ["POST"], handler: "resetAccountUsage" },
   { path: "/accounts/auto-reset", methods: ["POST"], handler: "setAutoResetCredits" },
   { path: "/accounts/draft", methods: ["POST"], handler: "createDraft" },
+  { path: "/accounts/siwc/draft", methods: ["POST"], handler: "createSiwcDraft" },
+  { path: "/login/siwc", methods: ["POST"], handler: "startSiwcLogin" },
   { path: "/login/device", methods: ["POST"], handler: "startDeviceLogin" },
   { path: "/login/pkce", methods: ["POST"], handler: "startPkceLogin" },
   { path: "/login/status", methods: ["GET"], handler: "getLoginStatus" },
@@ -3039,6 +3329,7 @@ export {
   CHATGPT_TARGET,
   CONTROL_HOST_CONTRACT_GAP,
   ControlError,
+  SIWC_TARGET,
   api,
   controlApi,
   controlRpc,
@@ -3047,4 +3338,4 @@ export {
   rpc
 };
 
-//# debugId=8A09446B1A0261F064756E2164756E21
+//# debugId=08B71A7DC584C3AB64756E2164756E21